This privacy notice sets out the way we process your information and details our privacy and fair processing policy. We will always refer to this page when we ask you for your consent. We will keep this page updated to show you all the things we do with your personal information so that you can be confident when sharing your information with us that it will be only used for what we say here.
Who we are
33A High Street
We are registered with the Charity Commission, and our registered charity number is 1158456.
We are registered as a data controller under the Data Protection Act 1998, and our Data Protection Register number is: Z2353271
Any electronic communications will be made in accordance with the Privacy and Electronic Communications Regulations (PECR)
What information do we collect about you?
We collect the personal data that you may share with us directly as part of completing a donation form, attending a Bridewell open day, e-newsletter sign-ups, ticket bookings, and visitor surveys.
Personal information we collect may include:
- your name, title, gender and date of birth;
- postal address, email address and phone number;
- family and spouse/partner details, relationships to other donors or service-users;
- current interests and activities.
We will also collect and hold information about any contact you have with us as a visitor or supporter of Bridewell, and may consist of details of:
- ticket purchase and event registration / attendance;
- online retail purchases;
- contact preferences;
- gift information, including Direct Debit bank details where applicable;
- Gift Aid status;
- details of correspondence sent to you, or received from you;
- employment information and professional activities;
- where relevant, selected media coverage;
- any other information provided by yourself to Bridewell, that we feel is relevant to your relationship with us. If it is potentially sensitive information, we promise to check with you first before recording it.
When we ask you to provide your personal information we will let you know why we are asking, and how we will use your data, by directing you towards this notice.
What we do with your information
Personal information provided to us will be used for the purposes outlined at the time of collection in accordance with the preferences you express.
Personal data collected and processed by us may be used for the following purposes:
- Administration of donations and legacies.
- Communication about our work, events, fundraising and other activities that we think may be of interest to you.
- Data cleansing, to check if we have accurate contact details for you - see How we update, screen and analyse your information for further information.
- To send you surveys, and for market research purposes.
- Tools may be used to monitor the effectiveness of our communications with you, including email tracking, which records when an e-newsletter from us is opened and/or how many links are clicked within the message. The data from this tracking is generally used in an aggregated and anonymised form.
- Occasionally we may also conduct additional research to understand you better and the areas of our work that you may be interested in supporting. See How we update, screen and analyse your information for further information.
We may also rely on our Legitimate Interest as a basis for processing personal information for the following:
To provide postal communications which we think will be of interest to you. You can opt out of any / all of our communications at any point simply by contacting firstname.lastname@example.org.
There are some communications that we are required to send regardless of your contact preferences. These are essential communications, deemed necessary to fulfil our contractual obligations to you. This would include Direct Debit confirmations and advanced notices, thank you letters, Gift Aid confirmation letters and querying returned mail or bounced Direct Debit payments with you.
How we update, screen and analyse your information
We regularly review records of supporters to ensure your data is as accurate as possible. Occasionally we may also conduct additional research to understand you better and the areas of our work that you may be interested in supporting. We may consult alternative sources such as:
- Royal Mail National Change of Address database (NCOA);
- BT Operator Services Information System (OSIS);
- Newspaper articles, publications and company websites;
- Companies House and other company information databases;
- Charity Commission and Office of the Scottish Charity Regulator (OSCR) registers;
- Any other publicly available sources.
You can opt-out of your data being used in this way simply by contacting email@example.com.
Who we might share your information with
Personal data collected and processed by us may be shared internally with the following groups where necessary: Bridewell employees, trustees and volunteers.
We do not disclose personal data to any third parties or external organisations, other than data processors carrying out work on our behalf.
Examples of such data processors would be bulk email distribution services such as MailChimp. Any such companies are acting as approved data processors for Bridewell, and we retain full responsibility for your personal data. Data processors will act only on our instructions.
Your data will never be sold or passed to any third party for any other purpose.
How we keep your information secure
We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control from:
- unauthorised access;
- improper use or disclosure;
- unauthorised modification.
All our employees and data processors, who have access to, and are associated with the processing of personal data, are legally obliged to respect the confidentiality of our service-users’ and supporters’ personal data.
How long we keep you information for
We hold your information only as long as necessary for each purpose we use it, for example some of our retention periods for different groups are as follows:
- Donors – up to 7 years from the last donation, in line with Gift Aid requirements
- Staff – indefinitely
- Individuals on our mailing list – 2 years since their last communication with us, at which point we will ask them to confirm their consent again, or delete their record.
How can I access the information about me, and correction of information?
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data – this is called a Subject Access Request.
To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed. There may also be a fee of up to £10 depending on the volume of work required.
Please try to be as clear as possible about the information you are seeking.
Once we have received your Subject Access Request, the agreed fee and proof of identity, you will receive a response from us within 40 days and you will be able to get copies of any information we hold on you. However, exemptions to disclosure may apply in some circumstances.
Subject Access Requests should be sent to:
33A High Street
At any time you may request that we delete or correct your personal information. If you wish to correct any information on you held by Bridewell, simply contact firstname.lastname@example.org.
Changes to our privacy notice
We regularly review our privacy notice, and may make changes time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last changed on April 2018.
How to contact us
If you have any comments on our privacy notice, or information we hold about you please contact us:
- by email to email@example.com.
- or write to us at Bridewell, 33A High Street, Witney. Oxfordshire. OX28 6HP